Repository navigation
ci: deploy the web app to GitHub Pages - #57
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (2)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex security review |
1 similar comment
|
@codex security review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: c24cfdedb3
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: ceec3ada0d
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
bfc4130 to
44b691d
Compare
|
@codex security review |
…d tests A second build with GRAPH_WEB_BASE set to a project-site sub-path is made in Playwright's global setup and previewed on its own port. The test checks that the shell, manifest scope, service worker scope and icons are served under the base and that no same-origin request falls outside it. GRAPH_WEB_BASE is declared in the _build task's env so turbo passes it to Vite and keys its cache on it.
Builds graph-web with the base set to the repository name and publishes it with the official Pages actions, pinned by SHA. The deploy job alone holds pages and id-token write and queues behind a running deploy rather than cancelling it.
A pure persistence policy, decided once in the composition root, forbids persisting when the hostname ends in .github.io, where every project site shares one origin and URL paths do not partition localStorage, IndexedDB or the origin private file system. In that mode the token and theme preference live in memory, sync records are not saved, the store is the store contract's in-memory fake instead of the OPFS SQLite worker, no service worker is registered, and a notice that cannot be dismissed says why. The end-to-end fixture, helpers and test are shared through e2e/support.ts so the new shared-origin test and the existing ones use one definition.
…gins Every site on the shared origin belongs to the owner, so the app persists as it does anywhere else. The README states that the token and synced data live in the browser origin the app is served from, that the Pages origin is shared across the organisation's sites, and that a deployment onto an origin with sites the deployer does not control must not persist a token. The shared end-to-end fixture module stays, since the existing tests use it.
44b691d to
de030b6
Compare
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Refs #56
Deploys the graph-web PWA to GitHub Pages as a project site at https://exadev.github.io/process-graph/ on every push to main.
The base was already read from
GRAPH_WEB_BASE(default/) with the manifeststart_urlandscopefollowing it. The new pieces are the workflow, an end-to-end test against a build made with the base set (shell, manifest and service worker scope, icons, and no same-origin request outside the base), andGRAPH_WEB_BASEdeclared in the_buildtask's env so turbo passes it through to Vite and keys its cache on it.pages.ymlhas a build job withcontents: readand a deploy job withpages: writeandid-token: write, concurrency grouppageswithcancel-in-progress: false, no secrets and nocontinue-on-error.GitHub Pages serves every project of the organisation from the single origin https://exadev.github.io, so the app's token and synced data in that origin's browser storage are readable by every page on it. This is accepted because all the sites on it are the owner's, and the README says so, and says that a fork deploying onto an origin shared with sites its owner does not control should not persist a token there.
Enabling Pages is a repository setting and not part of this PR. Someone with admin rights needs to run this once, and until they do the deploy job fails at its deployment step on the first push to main:
Once the first deploy is seen, #56 can be closed by hand.